Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...

learn more… | top users | synonyms

2
votes
3answers
272 views

Can this modified 'Many' Time Pad be made 'stronger' by using an extrememly long key?

Starting with a one time pad say you want to encrypt some small strings like the words in this sentence but you want to reuse the same OTP key for each string so that when you encounter the same word ...
22
votes
7answers
5k views

Why don't people hash and salt usernames before storing them

Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext. What I ...
9
votes
5answers
2k views

Whenever an unhandled exception somehow makes it into production, is it safe, viable, etc. to print an encrypted stack trace to the end user?

Whenever an unhandled exception makes it into production somehow - whatever the reason - there's generally an option (especially with .NET programs) to print out a stack trace to the end user before ...
90
votes
9answers
51k views

Why can we still crack snapchat photos in 12 lines of Ruby?

Just came across this bit of ruby that can be used to decrypt snapchat photos taken out of the cache on a phone, apparently adapted from here. To my surprise, it worked no problem, considering the ...
37
votes
3answers
45k views

Is Telegram secure?

There is a new WhatsApp-killer application called Telegram. They said that it's open source and that it has a more secure encryption. But they store all the messages in their servers and WhatsApp ...
12
votes
6answers
2k views

Do salts have to be random, or just unique and unknown?

First of all, my motive is to avoid storing the salt in the database as plain text. As far as this question is concerned, the salt is not stored in the database. After discussion in comments and in ...
59
votes
5answers
18k views

Is sending password to user email secure?

How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should i use encryption?
25
votes
8answers
2k views

Why is password hashing considered so important?

After reading this article, I can see the benefits of password hashing as a second layer of defence, in the event of an intruder gaining access to a password database. What I still don't understand is ...
31
votes
7answers
9k views

Is salting a hash really as secure as common knowledge implies?

(I did search on this topic, but I found no complete question/answer that addressed it, or even good portions of questions that might be relevant.) I'm implementing a salt function for user passwords ...
64
votes
3answers
20k views

How does Google Authenticator work?

Google Authenticator is an alternative to SMS for 2Step verification, installing an app on Android where the codes will be sent. It works without any connectivity; it even works on plane mode. This ...
-1
votes
1answer
14 views

combining imperfect random number generators for shuffling an array

Shuffling an array to create a random stream for encryption is well known. The weakness is in the security of the random number generator that performs the shuffling. But is it true or likely that the ...
1
vote
1answer
29 views

Using a Cryptovariable with an API Designed for Human-Generated Passwords

I'm working with a vendor who provides an API with a user registration method clearly designed for human-generated passwords. We're calling the API in an offline server-to-server fashion, however, ...
1
vote
1answer
193 views

How to secure my REST API once user authenticates with Google on mobile client?

In my application, I build REST APIs so that user can interact with my application server. Since I do not want to maintain User/Passwords, my iOS app authenticates client using Google. This all ...
0
votes
2answers
219 views

Generating authentication token from PHP sessions

I have a traditional PHP site which uses sessions. I've developed a real-time app in nodejs and wish to authenticate users here based on their PHP session. The procedure would go something like this: ...
3
votes
3answers
3k views

CryptoWall 3 - how to prevent and how to decrypt?

My father's computer is now infected with CryptoWall 3, according to the link below. http://www.bleepingcomputer.com/virus-removal/cryptowall-ransomware-information#CryptoWall Is there a way to ...
-1
votes
1answer
35 views

Do we need to same PGP version for decryption [on hold]

Requirement: In our company Location A uses PGP encryption and sending data over internet. In Location B, we have to decrypt the file. Question is what do we require in Location B Do we need to ...
1
vote
0answers
16 views

Does PKCS #7 (CMS) add assurance to an email if a CRL/OCSP response is included, then revoked?

Suppose I issue a signing certificate in January, and have a daily CRL issued (expires in 1 day) to verify the validity of that signature. Then sometime in July I need to revoke that certificate. My ...
15
votes
1answer
347 views

How to encrypt in PHP, properly?

How do I encrypt data in PHP, properly, using symmetric-key encryption? I have a message M and a secret S. I'm looking for a solution that uses cryptography properly without making any of the usual ...
1
vote
2answers
112 views

Using OAuth 2.0 without token storage

I am building a system for a product which requires Authentication and Authorization. Naturally I have chosen using OAuth 2.0 as it is a commonly used protocol and has proven to be useful. I am ...
312
votes
11answers
58k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the ...
-9
votes
0answers
51 views

Server side encryption [on hold]

In my research work i used only server side encryption of data and my external examiner asked that why I used RSA algorithm for encryption on only server-side and not client side so i am confused for ...
-3
votes
0answers
28 views

TLS vs other security protocols [on hold]

I'm currently working on my bachelor thesis, and without going to much into detail the main mission is to develop the possibility for sending media (pictures, videos and recordings) from the app on ...
2
votes
1answer
3k views

What is the deal with Valicert SSL root certificates?

Does anyone know what the status of the "Valicert Class 2 Validation Authority" root certificate is or what's going on with Valicert in general? I've heard that that cert has been deprecated, no ...
1
vote
1answer
113 views

How to store derby database encryption key in HSM?

The Derby Database supports encryption with a key or password. Traditionally this key is stored in the file systems, now I am looking to store and protect this key in the HSM instead, but I couldn't ...
0
votes
1answer
48 views

What is the security/copy protection model for streaming media services?

I realize this is a broad question, but maybe there is a simple answer From my understanding, Streaming media services such as Amazon instant video, Netflix, and others do all decryption client side. ...
-6
votes
1answer
37 views

Does an alternative approach to cryptography exist? [closed]

Is there an alternative approach to cryptography?
2
votes
1answer
57 views

Is TLS enough to prevent eavesdropping? [duplicate]

Is it enough to use only SSL/TLS for client-server application with authentication, registration and data transmission (like chat)? If it is not what I also need to use?
3
votes
1answer
4k views

4096 bit RSA encryption keys vs 2048

Where do 4096 bit RSA keys for SSL certs currently stand in terms of things like CA support, browser support, etc? In the overall scheme of things is the increased security worth the risk of 4096 bit ...
7
votes
4answers
383 views

Decentralised password recovery

Are there good/established techniques for password/key recovery in situations without a centralised service? (Anything goes, but I'd prefer solutions that distribute the recovery information across ...
2
votes
1answer
181 views

SIM card - Cryptography

I would like to have general infos about crypto and commom SIM card in mobile phone(I know there may be different implementations, technos according to the operator...). Is crypto used only for ...
3
votes
1answer
69 views

Security of hybrid encryption scheme

I want to use a hybrid encryption scheme for file encryption. The scheme must use PKCS#1 v1.5 – which is vulerable to padding oracle attacks – because many smartcards (e.g. the OpenPGP Card) only ...
5
votes
2answers
4k views

Tool or Process to check for AES-NI support on processor?

In another question, Thomas' answer mentioned the AES-NI instruction set, which piqued my curiosity. Is there a tool or process available out there to check whether the instruction set is available ...
3
votes
1answer
118 views

Has the security of PuTTY been examined?

I am wondering how PuTTY stacks up against other SSH implementations with respect to scrutiny and security of its SSH2 protocol implementation. PuTTY is probably the most-used SSH client on the ...
-1
votes
0answers
47 views

How to create a digial signature and verify it through a server [migrated]

I am trying to find out a way to create a digital signature for the employees of my company and place it in a server from where they can retrieve them and attach it with any digital document (Office ...
-2
votes
1answer
52 views

Tell type of encryption if given both input and output strings [closed]

I have the string Thisisatest that is encoded as MDQ4MGFhMzRhYTNkYjM1OGIzN2NkZTJhYjZiNjUzMjY= and I am trying to find out what encryption is used here. I think that the encoded string is base64 ...
1
vote
1answer
50 views

Why should I have my GPG key expire? [duplicate]

When creating a key pair using gpg it asks me for an expiration date: $ gpg --gen-key Please specify how long the key should be valid. 0 = key does not expire <n> = key expires ...
1
vote
2answers
51 views

Two-way encryption that can be nested?

In building a security system, I'm looking to prevent 'man-in-the-middle' attacks in a two-way encryption system, using the following setup: A sends B a message, encrypted with code 1 B sends it ...
7
votes
4answers
912 views

What happens when encrypting with private key? [duplicate]

I have a theoretical question. There is a public key-system. Person1 wants to privately send a message to person2. From my understanding, person1 is supposed to encrypt their message with public key. ...
0
votes
2answers
96 views

Is it possible to make a more secure random number generator algorithm by XORing two or more less secure random number algorithms?

Is it possible to make a more secure random number generator (e.g. for cryptologic purposes) by combining two or more less secure random number generator algorithms using XOR? Here is an example of ...
1
vote
0answers
63 views

Questions about SRP algorithm

I trying to use SRP algorithm but I have some questions: Is that a good choice to use for registration and authorization SRP algorithm with SSL/TLS? And for all other transmission using just ...
0
votes
1answer
84 views

Two-factor encryption model [closed]

Please some on help me to understand this "Are you ready for this? With the two-factor encryption model your data is protected two-fold. First, a unique key is generated, encrypted, and turned into ...
5
votes
3answers
5k views

How are “security levels” of identities in TeamSpeak 3 implemented?

TeamSpeak 3 VoIP communication system uses a concept of so called identities to identify the client to the server. These identities are basically public/private key pairs. In order to prevent people ...
0
votes
1answer
140 views

Asymmetric vs Symmetric Encryption Benchmarks

I have found these benchmarks in Crypto++'s site. http://www.cryptopp.com/benchmarks.html But I am, quite honestly, not entirely sure how to interpret them. I am really looking for a set of ...
2
votes
2answers
94 views

Encrypting USB traffic: Is RSA necessary for AES session key exchange when using pre-installed secret keys?

I need a solution to encrypt USB communication between device A and device B. I was thinking about configuring each device with a secret RSA-2048 key, which would be used to exchange an AES-256 ...
1
vote
1answer
67 views

How does OTR's authentication using “Question and answer” protect against MiTM?

I've read that the answer has something to do Socialist Millionaire, but I still don't understand how can the user be protected against malicious Man In The Middle, which would capture the question ...
2
votes
1answer
278 views

Requiring 2 keys to access a content

I need to use an external service that can only be accessed by password. I don't like the idea of storing the plaintext password on the server, but AFAIK there's not much I can do. Considering this ...
2
votes
1answer
40 views

What does a FIPS validation certificate cover? Just software version or OS and hardware too?

As I understand it, if you want to be FIPS-compliant you have to use FIPS-certified components. My question is how different can your use of the component by from what's on the component's validation ...
0
votes
2answers
100 views

Why use anything other than RSA for transmission encryption?

Being fairly new to the cryptography and data security space, I have sampled a few "Introduction to cryptography" sites/textbooks and they all seem to start in the same general way: This is a Caesar ...
45
votes
2answers
10k views

Amount of simple operations that is safely out of reach for all humanity?

Cryptographic primitives usually assert some security level given as number of operations to mount an attack. Hash functions, for example, give different security levels for collision attacks, ...
0
votes
1answer
85 views

Client authentication with a collection of open source distributed servers

With a collection of open source distributed servers, all sharing every users data. How can the user authenticate with any server, without the passwords being compromised by a malicious server? ...